Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

10/9/2019
04:40 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Security Tool Sprawl Reaches Tipping Point

How a new open source initiative for interoperable security tools and a wave of consolidation could finally provide some relief for overwhelmed security analysts and SOCs.

{Continued from Page 1}

GreyMatter basically aggregates security data from SIEMs, endpoint detection and response tools, firewalls, threat intelligence feeds, and other security tools, in addition to providing some of its own analytics and automation functions. "The main problem we want to solve is tools fatigue and vendor sprawl," says Joe Partlow, CTO of ReliaQuest. "CISOs are trying to adapt and get greater coverage of their attack surface, but the opposite is happening: not greater visibility ... but instead more complexity and data residing in silos" and more alerts than they can handle, he says.

GreyMatter basically does the dirty work of pulling together the different tools and their data. It gathers the data from the tools and then "normalizes" that data into a standard format for the platform. That replaces the spreadsheet-merging approach many organizations use to sort and correlate data from various tools.

Aaron Sherrill, a senior analyst at 451 Research, says many security tools are mostly just narrowly focused security features that ultimately get swallowed up by other vendors or get wrapped inside existing platforms — or fall by the wayside. "I view GreyMatter as aggregating a few different security approaches, [including] a managed service provider, SOAR, attack simulation," and some other security tools, Sherrill says. "It's [also] an opportunity for them to go a little deeper and look at the effectiveness of the tools in place," too, by providing the status and health of the various security tools in the organization's environment.

Anomali's Cagliostro, meanwhile, points out that one of the big drivers of security tool consolidation is security team turnover, which often results in losing expertise in specific security tools. When an analyst with expertise in reverse engineering gets hired away, for instance, notes Cagliostro, "institutional knowledge goes out the door with him."

Her firm's newly released Lens tool aims to provide all levels of the organization, including SOC analysts as well as company executives, alerts of an attack underway and what to do about it. Lens basically creates automated threat bulletins out of content it gathers online from threat intelligence findings, cybersecurity news articles, security logs, and other sources of threat information. Those bulletins then get absorbed into Anomali's threat intel system. Lens, the threat intel platform, and Anomali Match, an analysis tool, together make up Anomali's Altitude security management platform.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Can the Girl Scouts Save the Moon from Cyberattack?"

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
greg.jensen
50%
50%
greg.jensen,
User Rank: Author
11/22/2019 | 12:55:11 PM
46 point solutions per cyber analyst
This is a problem exasberated by the proliferation of point solutions that lack integration and creates gaps of capability between them.  According to my annual Cloud Threat Report, we found the average cyber analyst/leader is responsabile for 46 individual cyber solutions to manage risk and threats. This is a number that has been growing and consolidation (as you point out) is not only ineviable, it is critical to helping to reign it all in.  Great job on this article!
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7263
PUBLISHED: 2020-04-01
Improper access control vulnerability in ESConfigTool.exe in ENS for Windows all current versions allows a local administrator to alter the ENS configuration up to and including disabling all protection offered by ENS via insecurely implemented encryption of configuration for export and import.
CVE-2020-7066
PUBLISHED: 2020-04-01
In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_he...
CVE-2020-11445
PUBLISHED: 2020-04-01
TP-Link cloud cameras through 2020-02-09 allow remote attackers to bypass authentication and obtain sensitive information via vectors involving a Wi-Fi session with GPS enabled, aka CNVD-2020-04855.
CVE-2020-7064
PUBLISHED: 2020-04-01
In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.
CVE-2020-7065
PUBLISHED: 2020-04-01
In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.